Unauthorized Course Enrollment in Tutor LMS Plugin for WordPress

CVE-2025-13934

What is CVE-2025-13934?

The Tutor LMS plugin, used for eLearning and online course solutions on WordPress, is susceptible to a vulnerability that enables unauthorized course enrollment. All versions up to and including 3.9.3 are affected due to a lack of capability verification and purchasability validation within the course_enrollment() AJAX handler. This flaw permits authenticated users with subscriber-level access and higher to enroll themselves in any course without completing the necessary purchase process, thereby potentially compromising the intended access controls and revenue model of the courses.

References